Your Own Personal Enclave: The Smart Card Reader on the Librem 5

The risk with this approach is similar to the risk with a standard smartphone with disk encryption–in some countries you might be compelled to decrypt all encrypted volumes in extreme cases and if you carry all personas at all times the sensitive personas would still be at risk. Saying “I literally cannot decrypt this at this time because my smart card is at home” might prevent them from accessing the data then, but it could also lead to their confiscating the phone, detaining you, or preventing you from crossing the border altogether (or all of the above).

The safest approach when it comes to travel is one where you can fully comply with a search request (including unlocking a screen/decrypting a drive) and still lose no sensitive data.

This wouldn’t be an option for the smart card, but we intend to port PureBoot functionality like we have on our laptops to the Librem 5 in the future (it probably won’t be ready by Evergreen launch). In that case it would work like it does on Librem laptops, you would boot the phone w/ the Librem Key inserted (via a USB-A->USB-C adapter for existing Librem Keys) and see whether the Librem Key blinked green or red.

This can’t be done with the smart card by itself because it requires additional software to perform the HOTP algorithm that we have programmed onto the Librem Key.

5 Likes